publishAtomically

Shared atomic-publish helper: move temporary onto target with ATOMIC_MOVE, falling back to a plain replace when the filesystem can't do it atomically. Also used by BedrockConversion and NetworkSync so the publish semantics can't drift between the pipeline's writers.